ASD ISM 1926Restrict Identity Servers to Their Designed Role Only
Official control statement
Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are only used for their designed role and no other applications or services are installed, unless they are security related.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Keep domain controllers, AD CS, AD FS and Entra Connect servers single-purpose. Nothing else gets installed on them unless it is security related.
What this means in practice
This control says that four specific kinds of Microsoft identity servers must do one job and nothing else: Active Directory Domain Services (AD DS) domain controllers, Active Directory Certificate Services (AD CS) servers, Active Directory Federation Services (AD FS) servers and Microsoft Entra Connect servers. You do not install other applications or services on them. The only exception is software that is itself security related, such as endpoint protection or logging agents (other agents, such as backup software, only qualify where the organisation classifies them as security related and can justify that classification). It matters because these servers are the crown jewels of a Windows environment. A domain controller holds every account and password hash, AD CS issues the certificates the organisation trusts, AD FS signs the tokens that let people into cloud services, and Entra Connect holds the credentials that synchronise on-premises identities to the cloud. Every extra application on one of these hosts is extra attack surface: more code to patch, more services listening on the network, more local accounts and more chances for a vulnerability in something unrelated to hand an attacker control of the identity tier. It also blurs administration, because people who only need to manage the extra application end up with access to the identity server. Keeping the box single-purpose keeps the blast radius small and the hardening simple.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Server application hardeningTopic
Microsoft Active Directory services
Why it matters
If unrelated applications or services run on domain controllers, AD CS, AD FS or Entra Connect servers, a compromise of any of those applications can become a compromise of the whole identity tier. An attacker who gets code execution through a web app, database or utility on a domain controller can extract the AD database and every credential in it, forge certificates from AD CS, mint federation tokens from AD FS, or steal the synchronisation credentials from Entra Connect and pivot into the cloud tenant. Extra software also means more patching, more outages when it misbehaves, and more people holding access to servers that should have the tightest administration in the organisation.
Operational notes
Day to day this control is about resisting convenience. The temptation is always there to put a file share, print service, DHCP, a monitoring web console, a scripting host or a "just for now" utility on a domain controller because it is always on and already joined to everything. The answer is no, and that answer needs to come from a written standard rather than from whoever is on shift.
Keep a maintained list of the in-scope servers (every AD DS domain controller, AD CS server, AD FS server and Entra Connect server) and a short, explicit allow list of security-related software that is permitted on them, with a stated reason for each item. Anything not on that list is a change that needs approval before installation. When new domain controllers or other identity servers are built, use the same build standard so they start clean. Review installed programs, Windows features, server roles and running services on these hosts regularly, and treat any unexpected item as an incident to investigate rather than something to quietly tidy up. When a security agent needs to go on, record it on the allow list so the next review does not flag it as unknown.
Implementation tips
- The identity platform owner writes a build and configuration standard stating that AD DS domain controllers, AD CS servers, AD FS servers and Entra Connect servers are single-purpose, and lists by name the security-related software (for example endpoint protection, logging and backup agents) that is permitted on them.
- Systems administrators inventory every in-scope server and use PowerShell (Get-WindowsFeature, Get-Package, Get-Service) or the configuration management tool to export installed roles, features, applications and services, then remove or relocate anything that is not the designed role or an approved security tool.
- The change manager adds a mandatory approval step for any software or Windows feature installation on the in-scope servers, so that a request to add anything not on the security allow list is refused or escalated to the identity platform owner.
- Systems administrators apply an application control or software restriction policy scoped to the identity servers so that only the designed role binaries and the approved security software can execute, and configure it to block and log anything else.
- The security operations team configures the SIEM or monitoring platform to alert when a new service, scheduled task, Windows feature or installed program appears on a domain controller, AD CS, AD FS or Entra Connect server, and reviews each alert against the allow list.
Audit / evidence tips
- AskAsk for the standard or policy that governs what may be installed on domain controllers, AD CS, AD FS and Entra Connect servers.Look atCheck that it names all four server types, states they are single-purpose, and defines what counts as security-related software with a specific allow list.GoodA current, approved document covers all four server types and lists the permitted security tools by name with a reason for each.
- AskAsk for the current inventory of in-scope identity servers.Look atCompare it against the domain controller list from Active Directory, the certification authority list, the AD FS farm and the Entra Connect installations to see whether any servers are missing.GoodThe inventory matches what is actually deployed, and every server has a named owner and build date.
- AskAsk for a recent export of installed programs, Windows roles and features, and running services from a sample of the in-scope servers.Look atLook for anything beyond the designed role and the approved security software, such as file or print services, DHCP, web applications, databases or admin utilities.GoodOnly the designed role and allow-listed security software are present, and any exception has a documented approval.
- AskAsk how software installation on these servers is controlled and monitored.Look atLook for an application control or software restriction policy scoped to the identity servers and for alerting on new services, scheduled tasks or installed programs.GoodTechnical controls block unapproved software from executing, and alerts fire and are reviewed when something new appears.
- AskAsk for records of the last periodic review of installed software on the in-scope servers.Look atCheck who did the review, when, what was found and what was done about any unexpected item.GoodReviews happen on a defined schedule, findings are recorded, and removals or approvals are traceable through change records.
Cross-framework mappings
How ISM-1926 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 8.9 | ISM-1926 requires identity servers (AD DS/AD CS/AD FS/Entra Connect) to be restricted to their designed role, effectively constraining in... | |
| Annex A 8.19 | ISM-1926 requires that AD DS domain controllers, AD CS, AD FS, and Entra Connect servers are kept single-purpose, with no additional appl... | |
E8
| Control | Notes | Details |
|---|---|---|
extensionDepends on(1)expand_less | ||
| E8-AC-ML3.1 | ISM-1926 reduces the attack surface of AD servers by ensuring they only perform their intended roles without unrelated services | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.